The RCM Guide to Medical Credentialing and Provider Enrollment

:::info Quick answer Medical credentialing is the mandatory process of verifying a healthcare provider’s education, training, and licenses. It involves primary source verification followed by payer enrollment. Until a provider is fully credentialed and linked to your practice’s tax ID, insurance networks will reject their claims as out-of-network or deny them entirely. :::

A new orthopedic surgeon starts at your practice on Monday. They have a full schedule of patients, a spotless malpractice record, and a signed employment contract. But if you didn't start their paperwork three to four months ago, you are about to provide a lot of free orthopedic care.

If a new physician asks you what is medical credentialing, the easiest answer is that it's the 90-to-120-day waiting period between hiring a doctor and actually getting paid for their work.

In the revenue cycle world, credentialing is the absolute ground floor of cash flow. A billing team can scrub claims to perfection and append every modifier correctly, but if the provider rendering the service isn't properly linked to the group's Tax ID and loaded into the payer's system, the claim will hit a dead end. Usually, that dead end is denial code PR-B7 (This provider was not certified/eligible to be paid for this procedure/service on this date of service).

To keep your accounts receivable moving in 2026, you need to understand that credentialing isn't a single event. It is a two-phased ordeal involving primary source verification and network enrollment, heavily policed by federal databases and commercial payer bureaucracy.

The Two Phases of Getting Paid

Many practice managers use the terms "credentialing" and "enrollment" interchangeably. In reality, they are two distinct hurdles you must clear before you can bill a payer like Medicare, UnitedHealthcare, or Blue Cross Blue Shield.

Phase 1: Primary Source Verification (PSV)

Before an insurance company agrees to pay a provider, they must confirm the provider is who they say they are, holds the degrees they claim to hold, and has the legal right to practice medicine. This is Primary Source Verification (PSV).

Payers and credentialing committees adhere to strict guidelines, usually set by the National Committee for Quality Assurance (NCQA). They do not take a doctor's word for it. They go directly to the primary sources:

• State Medical Boards: To confirm active, unrestricted medical licenses.
• The DEA: To verify controlled substance registration.
• Medical Schools and Residency Programs: To verify graduation and completion dates.
• The NPDB (National Practitioner Data Bank): To check for malpractice payouts, license suspensions, or adverse clinical privilege actions.
• OIG LEIE: The Office of Inspector General's List of Excluded Individuals/Entities. If you hire a provider on this list, you cannot bill Medicare or Medicaid for their services, period.

Phase 2: Payer Enrollment and Contracting

Once a provider passes the PSV background check, phase two begins: Enrollment. This is the process of asking the payer to formally link the individual provider's Type 1 NPI (National Provider Identifier) to your organization's Type 2 NPI and Tax Identification Number (TIN).

For commercial payers, this often requires signing a joining addendum to your existing group contract. For Medicare, it means submitting the CMS-855I form to enroll the individual, and the CMS-855R to reassign their billing benefits to your group. Only when the payer countersigns the contract and officially loads the provider into their claims processing system does the provider become "participating" or "in-network."

The Core Components of a Credentialing Packet

To survive the credentialing gauntlet, you need a flawless paper trail. One missing date or expired document will drop your application to the bottom of a payer's 60-day processing queue.

Every provider onboarding packet must include:

• An active State Medical License (copy of the certificate and wallet card).
• A current DEA Registration Certificate.
• State Controlled Substance Certificate (if applicable in your state).
• Board Certification documents.
• Up-to-date Curriculum Vitae (CV) with month-and-year formatting for all work history.
• Certificate of Insurance (COI) for malpractice coverage, explicitly listing the provider's name and coverage limits (usually a minimum of $1M per occurrence / $3M aggregate).
• IRS Form W-9 matching the exact legal name of the practice.
• ECFMG Certificate (if the provider graduated from a foreign medical school).

The Role of CAQH ProView in 2026

Instead of mailing these documents to fifty different insurance companies, the industry relies on CAQH ProView. CAQH is an online repository where providers upload their credentials, work history, and demographic data.

Commercial payers like Aetna, Cigna, and UnitedHealthcare scrape this database to perform their PSV. However, CAQH only works if the provider authorizes the payer to view their profile, and if the provider re-attests to the accuracy of their profile every 120 days. A lapsed CAQH attestation is the number one cause of stalled commercial enrollment in 2026. If the system says "Attestation Expired," payers simply stop processing the application and wait, often without notifying the practice.

2026 Credentialing Timelines and Bottlenecks

Credentialing requires patience. Even with the ongoing rollout of PECOS 2.0 (Medicare's Provider Enrollment, Chain, and Ownership System), which has streamlined some backend processing, human review takes time. You must factor these timelines into your hiring cycle.

A crucial warning on retroactive billing: Medicare allows you to back-date an effective date up to 30 days from the date the Medicare Administrative Contractor (MAC) receives the application. Most commercial payers do not. If an Aetna contract becomes effective on October 1, any claims for dates of service in September will be denied as out-of-network. Holding commercial claims in your clearinghouse while waiting for a credentialing effective date is risky, as you will likely miss timely filing windows if the credentialing drags on.

Common Traps That Derail Provider Approvals

Even experienced credentialing specialists hit roadblocks. Payers are looking for reasons to delay applications, as delayed applications mean delayed claim payouts. Watch out for these specific traps.

Gaps in Work History

NCQA guidelines mandate that any gap in a provider's work history exceeding 30 days must be explained in writing. If a physician took three months off between residency and their first attending job in 2018, you must include a signed letter explaining the gap. If you leave a gap unexplained on a CV or in CAQH, the credentialing committee will reject the packet and ask for clarification, adding three weeks to your timeline.

Malpractice Ghost Details

When a provider joins your group, they usually fall under your group's malpractice policy. You must generate a COI showing their specific name. A common error is submitting the group's general COI that does not list the new provider as an additional insured. Furthermore, if the provider has past malpractice settlements on their NPDB record, you must preemptively supply a detailed letter from the provider explaining the clinical circumstances of the lawsuit, their involvement, and the settlement amount. Payers will find the settlement anyway; hiding it guarantees a delay.

The NPI Taxonomy Mismatch

Payers cross-reference the provider's Type 1 NPI registry data with the application. If a provider completed a fellowship in Cardiology but their NPI taxonomy code still lists them as an Internal Medicine resident, payers will flag the mismatch. Always update the NPPES (National Plan and Provider Enumeration System) registry before submitting payer applications.

Delegated Credentialing: The Fast Track

Large health systems and massive multi-specialty groups often bypass these delays through Delegated Credentialing.

Under a delegated agreement, an insurance company audits the medical group's internal credentialing department. If the group meets NCQA standards, the payer "delegates" the credentialing authority to the group. This means when the practice hires a new doctor, the practice does the background check internally, approves it, and simply sends a roster to the payer saying, "We hired Dr. Smith, load her into the network on Monday."

For independent practices and smaller groups, achieving delegated status is difficult due to the rigorous audit requirements and high minimum-provider counts demanded by payers. If you aren't delegated, you are at the mercy of the payer's standard processing times.

Maintaining Status: Revalidation and the No Surprises Act

Credentialing is not a "one and done" task. Providers must undergo recredentialing with commercial payers every two to three years. Medicare requires revalidation every five years for most physicians, and every three years for DME (Durable Medical Equipment) suppliers.

In 2026, the stakes for maintaining current records are higher than ever due to the enforcement phases of the Consolidated Appropriations Act (CAA) and the No Surprises Act. These federal laws require payers to maintain highly accurate provider directories.

To comply, health plans now force practices to verify their demographic data (address, phone numbers, accepting new patients status) every 90 days. If you fail to respond to a directory verification request, payers are legally obligated to suppress your providers from the online directory, and some payers will actively suspend claims payments until the data is verified.

Building a robust RCM operation requires treating credentialing as a continuous lifecycle. Use tracking spreadsheets or dedicated credentialing software to monitor CAQH expirations, medical license renewals, and DEA expiration dates. If a provider's medical license expires on a Friday, their payer contracts effectively terminate on Saturday, and every claim billed on Monday will hit your denial queues.

Frequently asked questions

How long does medical credentialing take in 2026?

Most credentialing and enrollment processes take between 90 and 120 days. Medicare generally processes applications in 45 to 90 days, while commercial payers like UHC and Aetna typically take 60 to 90 days, assuming the application is entirely error-free upon submission.

What is the difference between credentialing and payer enrollment?

Credentialing is the primary source verification (PSV) of a provider's qualifications, licenses, and background. Payer enrollment is the subsequent step where the verified provider is contracted and linked to your practice's Tax ID so you can bill the insurance company for their services.

Can I bill for a new doctor while waiting for their credentialing to complete?

Generally, no. Commercial payers will process claims as out-of-network or deny them entirely if the provider is not fully enrolled. Medicare allows retroactive billing up to 30 days prior to the date they receive the application. Billing a new doctor's services under an already-credentialed doctor's NPI is a compliance violation.

What happens if a provider forgets to attest their CAQH ProView profile?

CAQH requires providers to re-attest to their information every 120 days. If the profile expires, commercial payers will immediately halt any active enrollment applications or recredentialing processes until the attestation is completed, often delaying effective dates by weeks.

What is delegated credentialing?

Delegated credentialing is an arrangement where a payer allows a large healthcare organization to perform its own primary source verification. The organization internally credentials a new hire and sends a roster update to the payer, bypassing the 90-day wait time for payer-side credentialing.